CVE-2026-119546

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

6.8 Medium

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.15%Unchanged since Oct 31, 2026

What each source reports

CVE List Score used 6.8

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

Record: CVE-2026-119546
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-04

EUVDEUVD-2026-113811 6.8

Record: EUVD-2026-113811
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-gx58-cw96-3j3q 6.8

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path...

Record: GHSA-gx58-cw96-3j3q
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

NVD 6.8

Record: CVE-2026-119546
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-04

Affected products

forgejo

History

History
Recorded	Changed	Sources
Nov 4, 2026	references	CVE List
Nov 4, 2026	facts	EUVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119546 is a medium vulnerability (CVSS 6.8) in Forgejo, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. No source names a fixed version.